Planning the job and preparing the plant

Most permit failures are set up long before anyone arrives at the worksite. A job that is planned in a hurry, with an out-of-date drawing, a missing blind on the list or no thought for how the equipment will be emptied, puts the issuer and the crew in the position of making critical decisions in the field with incomplete information. HSE-221 described the permit life cycle from request to close-out. This lesson looks at the front end of that cycle on oil and gas sites: turning a work request into a planned job, assessing the risks, building the work pack, and preparing the plant so that the equipment really is empty, cool and safe to open when the crew arrives.

From work request to planned job

Work usually starts as a request in the maintenance system: a leaking valve, a failed instrument, an inspection due date or a modification. A planner, often working with operations and engineering, turns the request into a job by defining the scope, identifying the equipment and its boundaries, checking drawings, deciding the method, listing materials and tools, and estimating time and crew. On oil and gas sites, planning also has to answer questions that a factory planner rarely faces:

• What production must be shut in or diverted, and for how long, and who must agree?
• Where will the hydrocarbons in the equipment go: to the flare, to a vapour recovery system, to a closed drain, to a tank or to a vacuum truck?
• Can the flare and drain systems take the volume at the rate needed, and what happens in cold weather?
• Does the job affect any well, pipeline or neighbouring operator, and do they need notice?
• Does the job need any temporary change, such as a temporary bypass, hose or tie-in, that should go through management of change?

Assessing the risks

Every permitted job needs a risk assessment, but its depth should match the hazard. A field-level hazard assessment by the crew at the worksite is enough for simple work. A formal task risk assessment, done in advance by the planner, operations and the contractor together, is needed for line opening in sour service, vessel entry, hot work in process areas, critical lifts and any non-routine operation. HSE-223 covers risk assessment methods in depth. For oil and gas work, the assessment should specifically ask the questions raised by the incidents in Lesson 1: what isolation standard does the hazard need, what could the isolation trap inside, how will zero pressure be confirmed, what ignition sources and openings are nearby, and what else is happening in the area at the same time.

The Williams Geismar incident is a reminder that the most dangerous jobs are often the non-routine operating steps around maintenance, such as switching equipment in and out of service, warming up or cooling down, or putting equipment on standby. If a planned job requires operations to do something they do not do every week, that operating step needs a procedure and a hazard review of its own, not just the maintenance task.

The work pack

A good work pack gives the issuer and the crew everything they need in one place. For an oil and gas job it usually includes:

• a clear scope statement with the equipment tag numbers and boundaries;
• a marked-up piping and instrument diagram or isolation sketch showing every isolation point, vent, drain and blind, checked in the field against the actual piping;
• a blind list with blind sizes, ratings and locations;
• the step-by-step job procedure, including the operating steps to prepare and later restore the plant;
• the list of permits and linked certificates the job needs, as in Lesson 4;
• the task risk assessment and any engineering approvals, such as for welding near pressure piping;
• material and equipment certifications, such as gasket and bolt specifications and lifting gear inspections;
• known simultaneous operations and how they will be managed, as covered in Lesson 10.

Out-of-date drawings are one of the most common causes of missed isolation points. Field changes that were never recorded, abandoned lines that were never removed, and instrument connections that were added later can all leave a path to the work that the drawing does not show. A field walk-down by the planner and an operator, tracing every line from the equipment to its isolation points, catches most of these. The CER's 2022 advisory found mislabelled and unlabelled valves in the field, which is exactly what a walk-down should find and fix.

Preparing the plant: depressuring

Before equipment is opened, operations bring it to a safe state: isolated from its sources, depressured, drained, purged and, where needed, cooled or warmed. Depressuring is usually done to the flare or vapour recovery system through blowdown valves or vents. Two oil and gas hazards come with it. First, gas cools sharply as it expands through a valve, which can freeze valves, form hydrates and in severe cases chill piping below its safe temperature, as HSE-332 explained. Second, the last part of the depressuring is slow, so impatience tempts crews to open a joint while some pressure remains.

The program below estimates how long a section of piping takes to bleed down from operating pressure to near atmospheric through a small vent. It assumes choked flow while the pressure ratio allows and then a slower subsonic phase, with invented sizes. It is a teaching approximation, not a design method, but it shows why the last part of the bleed-down takes longer than the first.

# Bleed-down of an isolated section through a small vent (teaching approximation).
import math
V = 1.5                  # section volume, m3 (invented)
d_mm = 6.0               # vent orifice, mm (invented)
p_gauge_kpa = 4500.0     # starting pressure, kPa gauge
T, R, Mw, k, Cd = 288.0, 8.314, 0.019, 1.3, 0.6
A = math.pi * (d_mm / 1000) ** 2 / 4
p_atm = 101_325.0
p = (p_gauge_kpa * 1000) + p_atm
crit = ((k + 1) / 2) ** (k / (k - 1))           # pressure ratio for choked flow
t, marks = 0, [3000, 1000, 300, 100, 20]
while p - p_atm > 5_000:
    if p / p_atm > crit:                          # choked
        mdot = Cd * A * p * math.sqrt(k * Mw / (R * T) * (2 / (k + 1)) ** ((k + 1) / (k - 1)))
    else:                                         # subsonic
        r = p_atm / p
        mdot = Cd * A * p * math.sqrt(2 * k / (k - 1) * Mw / (R * T) * (r ** (2 / k) - r ** ((k + 1) / k)))
    p -= mdot * R * T / (Mw * V)                  # 1-second step, isothermal ideal gas
    t += 1
    while marks and (p - p_atm) / 1000 <= marks[0]:
        print(f"down to {marks.pop(0):>5} kPa gauge after {t / 60:5.1f} min")
print(f"down to     5 kPa gauge after {t / 60:5.1f} min")

down to  3000 kPa gauge after   2.5 min
down to  1000 kPa gauge after   8.9 min
down to   300 kPa gauge after  15.2 min
down to   100 kPa gauge after  19.4 min
down to    20 kPa gauge after  22.8 min
down to     5 kPa gauge after  24.1 min

Most of the pressure bleeds off in under ten minutes, but the last part, from about 1,000 kPa (145 psi) down to near zero, takes half again as long, because the driving pressure is so small. A crew that sees the gauge fall quickly and assumes the job is done may open a joint with real pressure behind it. The permit should state how zero pressure will be confirmed, such as an open vent with no flow for a set time plus a gauge reading on a calibrated gauge, and the crew should wait for it.

Preparing the plant: draining and purging

After depressuring, liquids are drained to a closed drain, a tank or a vacuum truck, and the equipment is purged to remove remaining gas. HSE-332 described the hazards of nitrogen, steam and air purging. Two purging methods are common in oil and gas:

• Pressure-cycle purging: the equipment is pressured with nitrogen, held so the gas mixes, then vented, and the cycle is repeated. Each cycle reduces the concentration of the original gas by roughly the ratio of the low to high absolute pressure.
• Flow-through purging: nitrogen or steam flows in at one end and out at the other for several volume changes. With good mixing, each volume change reduces the concentration by a factor of about e, or 2.7.

The program below estimates how many cycles or volume changes are needed to bring H2S in a vessel from its starting level down to a target before opening. Actual purge completion must always be confirmed by gas tests at several points, because dead legs and poor mixing can leave pockets of gas behind.

# How much purging brings H2S down to a target? (ideal mixing; confirm with gas tests)
import math
start_ppm = 5000.0          # H2S in the vessel after depressuring (0.5 percent)
target_ppm = 10.0
p_low = 101.3               # kPa absolute (vented)
p_high = 101.3 + 600.0      # kPa absolute (pressured with nitrogen to 600 kPa gauge)
ratio = p_low / p_high
cycles = math.ceil(math.log(target_ppm / start_ppm) / math.log(ratio))
print(f"Pressure-cycle purge to 600 kPa gauge: each cycle multiplies H2S by {ratio:.3f}")
c = start_ppm
for n in range(1, cycles + 1):
    c *= ratio
    print(f"   after cycle {n}: about {c:7.1f} ppm")
changes = math.log(start_ppm / target_ppm)
print(f"Flow-through purge: about {changes:.1f} volume changes with perfect mixing")
print(f"Allowing for poor mixing (factor 2): about {2 * changes:.0f} volume changes")

Pressure-cycle purge to 600 kPa gauge: each cycle multiplies H2S by 0.144
   after cycle 1: about   722.2 ppm
   after cycle 2: about   104.3 ppm
   after cycle 3: about    15.1 ppm
   after cycle 4: about     2.2 ppm
Flow-through purge: about 6.2 volume changes with perfect mixing
Allowing for poor mixing (factor 2): about 12 volume changes

Four pressure cycles bring the calculated H2S below the target, and a flow-through purge needs about six volume changes with perfect mixing or a dozen allowing for poor mixing. The calculation tells the planner how much nitrogen and time to allow; it does not replace the gas test. Purge gas and the H2S it carries must vent to a safe place such as the flare, never into a building or low area where people work.

What the isolation might trap

Planning must also look at the equipment after it is isolated. Liquid trapped between closed valves expands when the sun warms it and can burst piping or gaskets; equipment cut off from its relief valve, as at Geismar, has no protection from heat or a passing valve; and a heat exchanger with one side isolated and the other still in service can be overpressured by heat transfer. Good practice is to drain liquids from isolated sections, keep a relief path or open vent on isolated equipment where possible, and include in the plan how the isolated equipment will be protected for as long as it stays isolated.

The pre-job walk-down and handover to the crew

When preparation is complete, the issuer, the isolating authority and the receiver walk the job together. They check each isolation point against the certificate, confirm the vents and drains are open and clear, read the gas tests, look at the surroundings for ignition sources and other work, and agree on what the crew will do if something unexpected happens. Only then is the permit issued. If the walk-down finds that the plant is not ready, for example a valve that will not close fully or a drain that is plugged, the job waits. Pressure to start on time is never a reason to accept a plant that is not ready.